Legal · Privacy Policy
Privacy.
Your boards are yours.
Contents
01What we collect 02How we use it 03AI and your boards 04Sub-processors 05Data residency 06Your rights (GDPR) 07Cookies 08Retention and deletion 09Contact
Data requests?
support@taulu.app
§ 01What we collect
Two kinds of data. Account data — your name, email, and org membership — which you give us to run your account. And board data — the cards, stickies, comments and attachments your team makes — which we hold on your behalf. We collect the minimum to run the service and never buy data about you from third parties.
§ 02How we use it
To operate Taulu: authenticate you, sync boards in real time, send the emails the product needs (sign-in links, invites), and keep the service healthy through error reporting and server logs. We do not sell your data, and we do not run ads.
§ 03AI and your boards
The only AI feature is photo import: when you explicitly ask Taulu to turn a photo of a whiteboard into board items, that image is processed by Mistral AI (EU) and the result comes straight back to your board. Nothing else you make is ever sent to an AI provider, and no models are trained on your boards — not ours, not anyone else's.
§ 04Sub-processors
We use a short list of sub-processors: UpCloud (servers and object storage, EU), Bunny.net (DNS, CDN and video delivery, EU company), Brevo (transactional email, EU), and Mistral AI (photo import only, EU). We'll update this list here before adding one.
§ 05Data residency
Board data, attachments and backups live in Helsinki, Finland, on EU-owned infrastructure. We will tell you, in advance, before any of this changes.
§ 06Your rights (GDPR)
You can access, correct, export or delete your data at any time. Email support@taulu.app and we fulfil access, export and deletion requests within 30 days — usually much faster. You can also object to processing and lodge a complaint with your local supervisory authority.
§ 07Cookies
Practically none. Signing in works with a token in your browser's local storage, not a tracking cookie. The one true cookie is a short-lived technical cookie that exists only during a third-party sign-in (Google or GitHub) to protect the handshake, and it expires right after. No advertising or cross-site tracking cookies — so there's no consent wall to click through.
§ 08Retention and deletion
Board data lives as long as the board does. Delete a board and it sits in Trash for 7 days, then it's purged. Ask us to close your account and we delete account data within 30 days, except what we must keep for legal reasons.
§ 09Contact
Questions, requests, or concerns go to support@taulu.app. We read every message and prefer to resolve things directly before anything formal.